OpenVPN under Windows Server 2008 R2. How is it that bad?

UncleBob

Hello.

I have a pretty weird situation I'm using OpenVPN for. I've got an office LAN NAT'ed behind Ubuntu Server machine. And I have a remote dedicated Windows 2008 R2 server located in a datacenter in the Netherlands, which I wanna connect to the LAN.

The office uplink is 100Mbps, as well as the server's, but the direct connection routed very poorly and the max speed that you can get directly is about 10Mbps, which is pretty sad. So I rented a small VPS somewhere else, that has 100Mbit direct connection speeds to both - the office LAN and the server (1 NIC). It's located pretty much closer to the LAN though (same city, ping 1ms). Ping to NL server is about 35ms.

Now I'm trying to OpenVPN all these 3 servers - Ubuntu office gateway, Ubuntu VPS and Windows 2008 R2. Ubuntu VPS acts as OpenVPS server, two other machines are OpenVPN clients.

After a couple days of understanding all that jazz about openvpn and client config files, I've got a working setup with proper routes and stuff, but here's the issue I'm currently having.

As I mentioned, the VPS has a full speed 100Mbps direct connection to both client machines over the Internet. And I've got almost the same 100Mbps between the VPS and the office over OpenVPN. But, between the VPS and Windows server, I'm getting much less speeds. From Windows to VPS it's quite steady 25Mbps, from VPS to Windows in general it's higher, up to 50-60Mbps, but randomly dropping to 10Mbps and lower.

I'm testing the speeds by transferring 3Gb file of random data through http with wget. Direct transfer of this file over the Internet gives steady 100Mbps in any direction between Windows and VPS machines with no speed drops.

The speed between office and Windows server (OpenVPN clients) is quite steady 20Mbps from Windows to office and unstable up to 40Mbps back. I also tried to copy files using Microsoft file sharing from the ofiice LAN to Windows server and back, getting around 15/10-30Mbps from/to Windows server.

I have enabled Jumbo packets in Windows Server NIC properties, so it has MTU of 9000 on it's external NIC.

I've been playing with MTU without much luck. Lowering MTU resulted slower speeds, raising MTU forced unstable (halting) connection, but higher speeds in general.

I think I was able to change MTU under Windows using netsh interface ipv4 set subinterface "OpenVPN virtual adapter name here" mtu=XXX command. At least it was changing, what I was able to see using netsh interface ipv4 show subinterfaces command.

Any thoughts how to check what causing such a slow and strange performance under Windows?

I'm using tun/udp OpenVPN channel configuration btw...

UncleBob

Ok, after all my failure with Windows, now I have Ubuntu installed instead. And still having the same issues with speed.

Any suggestions how to tune the tunnel connection, so it gets anywhere closer to direct connection speed?

I tried variety of MTU settings from below 1000 to 32000 with no visible impact. The configs as follows

server

local xx.xx.xx.xx
port 60443
proto udp
dev tun
ca keys/ca.crt
cert keys/server.crt
key keys/server.key  # This file should be kept secret
dh keys/dh1024.pem
server 10.0.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
client-config-dir ccd
route 192.168.0.0 255.255.255.0
route 10.1.0.0 255.255.255.252
route 10.2.0.0 255.255.255.252
keepalive 10 30
comp-lzo
persist-key
persist-tun
status openvpn-status.log
verb 3

client

client
dev tun
proto udp
remote zzz.openvpn.server 60443
nobind
persist-key
persist-tun
ca keys/ca.crt
cert keys/nl-client.crt
key keys/nl-client.key
ns-cert-type server
comp-lzo
verb 3

nl-client config in ccd

ifconfig-push 10.2.0.1 10.2.0.2
push "route 192.168.0.0 255.255.255.0"
push "route 10.1.0.0 255.255.255.252"

another client 10.1.0.1 with NAT 192.168.0.0 is configured pretty much the same, but it has no speed issues with the server, only nl-client does

UncleBob

Ok, now I have decided get rid of the openvpn server in the middle and changed it to squid3 http-proxy. When I test http download through this proxy over the internet, I'm getting up to 90Mbps to both sides - from dedi to lan and back.

I have changed configs, so my dedi machine is now a openvpn server, my lan gateway is a client and the tunnel is tcp over http-proxy. Guess what speeds I'm getting? Less than 10Mbps :shock:

I tried nearly everything and getting more and more frustrated after every other step, can you suggest anything else?

strfr

Exactly the same over here buddy, see my post here: https://forums.openvpn.net/topic14122.html?hilit=slow%20windows

This is by my opinion problem of the Windows clients only, something with the TAP driver or I do not know what.. I can try to use older Win clients, but this needs so much time which I am really missing..

lukit

Had almost the same issue. Fixed by:

sndbuf 200000
rcvbuf 200000